metmaklogin[.]wordpress[.]com

On 23 July 2026 the domain metmaklogin.wordpress.com was observed delivering a credential‑collection page titled “MetaMask Log In | Cryptocurrency Exchange”. The page title explicitly references MetaMask, indicating a brand‑impersonation attempt aimed at cryptocurrency users. VirusTotal scans show that 13 of 95 security vendors have flagged the domain as malicious, providing independent confirmation of its abusive nature. DNS resolution points to the IP address 192.0.78.12, which belongs to AS2635 operated by Automattic, Inc., the host of the WordPress.com service. The domain is served by WordPress, MySQL, PHP, Nginx and is protected by HSTS and HTTP/3, consistent with the typical WordPress.com stack.

The HTTP response code returned is 410 (Gone), and the site has been taken offline, as reflected by the current status. Despite removal, the domain remains listed on at least one public blocklist; PhishDestroy has recorded it as blocked. Registration data show the domain was created on 3 March 2000 and was registered through MarkMonitor, Inc., a registrar frequently used by legitimate enterprises, which may aid the attacker in gaining initial trust. The SSL certificate is issued by Let’s Encrypt (identifier E8), offering a valid TLS connection but providing no indication of legitimacy.

The site is classified as a crypto‑related scam, specifically a MetaMask impersonation, targeting users seeking to manage digital assets. Uncertainties remain regarding the exact phishing kit used and any additional infrastructure that may have supported the campaign before takedown. Defenders should continue to block the domain at network perimeter and DNS layers, monitor for any resurgence of the same subdomain pattern, and update endpoint protection rules to reflect the 13 vendor detections reported by VirusTotal.